Cannot exclude a param from OAuth signature (flickr file upload) about requests-oauthlib

[ib-lundgren]

This is indeed curious behaviour and a great example of the real reason OAuth 1 is a bit of a mess (trying to recreate SSL). Flickr are essentially extending the OAuth RFC, which does not cover protection of body parameters in multi part requests. What they are doing does not add a whole lot of value as it does not protect the binary blob (photo) itself.

There is currently no support for this in requests-oauthlib. It can be worked around but not very cleanly. What you would need to do is use the OAuth1 auth client (requests_oauthlib.OAuth1) and create one prepared request and one real request. Something a long the lines of

import requests
import requests_oauthlib
flickr = 'http://up.flickr.com/services/upload/'
client = requests_oauthlib.OAuth1('your_client_key', ....)
data = { 'title': 'sometitle', 'description': '...'}
raw = requests.Request('POST', flickr, data=data, auth=client)
prepared = raw.prepare()
auth = {'Authorization': prepared.headers.get('Authorization')}
requests.post(flickr, data=data, headers=auth, files=(('photo', '/home/you/photo.jpg'),))

but I've not tested whether this works.

[dargad]

The workaround works as expected, thanks!

[ib-lundgren]

Don't think this is a common enough case to be included in the library but a good candidate for inclusion in the documentation. Labelling docs for now and will close when its featured in the docs somewhere. cc #48